macOS .Net Applications Injection

Learn & practice AWS Hacking:HackTricks Training AWS Red Team Expert (ARTE) Learn & practice GCP Hacking: HackTricks Training GCP Red Team Expert (GRTE)

Support HackTricks

• Check the subscription plans!

• Join the 💬 Discord group or the telegram group or follow us on Twitter 🐦 @hacktricks_live.

• Share hacking tricks by submitting PRs to the HackTricks and HackTricks Cloud github repos.

Hii ni muhtasari wa chapisho https://blog.xpnsec.com/macos-injection-via-third-party-frameworks/. Angalia kwa maelezo zaidi!

.NET Core Debugging

Kuweka Kikao cha Ufuatiliaji

Usimamizi wa mawasiliano kati ya debugger na debuggee katika .NET unashughulikiwa na dbgtransportsession.cpp. Kipengele hiki kinaanzisha bomba mbili zenye majina kwa kila mchakato wa .NET kama inavyoonekana katika dbgtransportsession.cpp#L127, ambazo zinaanzishwa kupitia twowaypipe.cpp#L27. Mabomba haya yanaishia na -in na -out.

Kwa kutembelea $TMPDIR ya mtumiaji, mtu anaweza kupata FIFOs za ufuatiliaji zinazopatikana kwa ajili ya ufuatiliaji wa programu za .Net.

DbgTransportSession::TransportWorker inawajibika kwa usimamizi wa mawasiliano kutoka kwa debugger. Ili kuanzisha kikao kipya cha ufuatiliaji, debugger lazima itume ujumbe kupitia bomba la out linaloanza na muundo wa MessageHeader, ulioelezwa katika msimbo wa chanzo wa .NET:

struct MessageHeader {
MessageType   m_eType;        // Message type
DWORD         m_cbDataBlock;  // Size of following data block (can be zero)
DWORD         m_dwId;         // Message ID from sender
DWORD         m_dwReplyId;    // Reply-to Message ID
DWORD         m_dwLastSeenId; // Last seen Message ID by sender
DWORD         m_dwReserved;   // Reserved for future (initialize to zero)
union {
struct {
DWORD         m_dwMajorVersion;   // Requested/accepted protocol version
DWORD         m_dwMinorVersion;
} VersionInfo;
...
} TypeSpecificData;
BYTE          m_sMustBeZero[8];
}

Ili kuomba kikao kipya, muundo huu unajazwa kama ifuatavyo, ukipanga aina ya ujumbe kuwa MT_SessionRequest na toleo la protokali kuwa toleo la sasa:

static const DWORD kCurrentMajorVersion = 2;
static const DWORD kCurrentMinorVersion = 0;

// Configure the message type and version
sSendHeader.m_eType = MT_SessionRequest;
sSendHeader.TypeSpecificData.VersionInfo.m_dwMajorVersion = kCurrentMajorVersion;
sSendHeader.TypeSpecificData.VersionInfo.m_dwMinorVersion = kCurrentMinorVersion;
sSendHeader.m_cbDataBlock = sizeof(SessionRequestData);

Hii kichwa kisha kinatumwa kwa lengo kwa kutumia syscall ya write, ikifuatwa na muundo wa sessionRequestData unao zawadi ya GUID kwa ajili ya kikao:

write(wr, &sSendHeader, sizeof(MessageHeader));
memset(&sDataBlock.m_sSessionID, 9, sizeof(SessionRequestData));
write(wr, &sDataBlock, sizeof(SessionRequestData));

Operesheni ya kusoma kwenye bomba la out inathibitisha mafanikio au kushindwa kwa kuanzishwa kwa kikao cha ufuatiliaji:

read(rd, &sReceiveHeader, sizeof(MessageHeader));

Kusoma Kumbukumbu

Mara tu kikao cha ufuatiliaji kimeanzishwa, kumbukumbu inaweza kusomwa kwa kutumia MT_ReadMemory aina ya ujumbe. Kazi readMemory inaelezewa kwa undani, ikifanya hatua zinazohitajika kutuma ombi la kusoma na kupata jibu:

bool readMemory(void *addr, int len, unsigned char **output) {
// Allocation and initialization
...
// Write header and read response
...
// Read the memory from the debuggee
...
return true;
}

The complete proof of concept (POC) is available here.

Writing Memory

Vivyo hivyo, kumbukumbu inaweza kuandikwa kwa kutumia kazi ya writeMemory. Mchakato unahusisha kuweka aina ya ujumbe kuwa MT_WriteMemory, kubainisha anwani na urefu wa data, na kisha kutuma data:

bool writeMemory(void *addr, int len, unsigned char *input) {
// Increment IDs, set message type, and specify memory location
...
// Write header and data, then read the response
...
// Confirm memory write was successful
...
return true;
}

The associated POC is available here.

.NET Core Code Execution

Ili kutekeleza msimbo, mtu anahitaji kubaini eneo la kumbukumbu lenye ruhusa za rwx, ambalo linaweza kufanywa kwa kutumia vmmap -pages:

vmmap -pages [pid]
vmmap -pages 35829 | grep "rwx/rwx"

Kuweka mahali pa kufuta kiashiria cha kazi ni muhimu, na katika .NET Core, hii inaweza kufanywa kwa kulenga Dynamic Function Table (DFT). Meza hii, iliyoelezewa katika jithelpers.h, inatumika na mfumo wa uendeshaji kwa kazi za msaada wa JIT.

Kwa mifumo ya x64, uwindaji wa saini unaweza kutumika kupata rejeleo kwa alama _hlpDynamicFuncTable katika libcorclr.dll.

Kazi ya ku-debug MT_GetDCB inatoa taarifa muhimu, ikiwa ni pamoja na anwani ya kazi ya msaada, m_helperRemoteStartAddr, ikionyesha mahali ambapo libcorclr.dll iko katika kumbukumbu ya mchakato. Anwani hii kisha inatumika kuanza kutafuta DFT na kufuta kiashiria cha kazi kwa anwani ya shellcode.

Msimu kamili wa POC wa sindano katika PowerShell unapatikana hapa.

Marejeleo

• https://blog.xpnsec.com/macos-injection-via-third-party-frameworks/

Learn & practice AWS Hacking:HackTricks Training AWS Red Team Expert (ARTE) Learn & practice GCP Hacking: HackTricks Training GCP Red Team Expert (GRTE)

Support HackTricks

• Check the subscription plans!

• Join the 💬 Discord group or the telegram group or follow us on Twitter 🐦 @hacktricks_live.

• Share hacking tricks by submitting PRs to the HackTricks and HackTricks Cloud github repos.